Another allowed-ips question

[Reuben Martin]

On Nov 18, 2017 5:44 PM, "Ryan Whelan" <rcwhelan at gmail.com> wrote:

I'm working on a system where Wireguard machines can connect directly to
one another as well as communicate with one another via an intermediary
router (or 'server').

When 2 machines directly connect to one another, the allowed-ips setting is
obviously a non-issue; what i'm struggling with is if they are unable to
communicate directly and build routes to one another via an intermediary
router (which is also connected to each 'client' via wireguard).  Unless
the 'server' NATs the traffic, the allowed-ips setting will prevent the
'clients' from communicating.  Am i missing something?

I'm trying to avoid building a wg interface for each peer connection if
possible, but i'm failing to see any other way around it.  Either NAT at
the intermediary router or create an interface per-peer.

Are there other options?


I have something kinda similar. I set up vxlan connections overtop of the
wireguard connections and added the vxlan interfaces to bridges.

-Reuben
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20171118/7ba5c872/attachment.html>